Closed Bug 715056 Opened 11 years ago Closed 11 years ago

"ASSERTION: wrong node" and crash [@ nsIRange::UnregisterCommonAncestor]

Categories

(Core :: DOM: Selection, defect)

Product:
Core
Component:
DOM: Selection
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED FIXED
Milestone:
mozilla12

People

(Reporter: jruderman, Assigned: MatsPalmgren_bugz)

Details

(Keywords: assertion, crash, testcase, Whiteboard: [inbound])

Attachments

(4 files)

testcase (crashes Firefox when closed)
339 bytes, text/html
Details
stack trace
10.81 KB, text/plain
Details
fix
2.94 KB, patch
smaug
: review+
Details | Diff | Splinter Review
crashtest
1.17 KB, patch
Details | Diff | Splinter Review 
Closing the testcase triggers:

###!!! ASSERTION: wrong node: 'aNode->IsCommonAncestorForRangeInSelection()', file /builds/slave/m-cen-osx64-dbg/build/content/base/src/nsRange.cpp, line 429

Crash [@ nsIRange::UnregisterCommonAncestor]
Attached file stack trace — 

    
    

    
  
The text nodes we're normalizing are children of the document, so we're falsely
triggering aNotInsertedYet==true in nsRange::CharacterDataChanged:
http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsRange.cpp#556
because I should have used GetNodeParent(), not GetParent().  Bah!

Try results pending:
https://tbpl.mozilla.org/?tree=Try&rev=5b0e7f840554
Assignee: nobody → matspal
OS: Mac OS X → All
Hardware: x86_64 → All

    
    

    
  

      
      
      
      

        Attached patch
          
          
        fix
        — 
          — Splinter Review
      

    


  

        Attachment #585853 -
        Flags: review?(bugs)

    
    

    
  

      
      
      
      

        Attached patch
          
          
        crashtest
        — 
          — Splinter Review
      

    


  

        Attachment #585853 -
        Flags: review?(bugs) → review+

          You need to log in
          before you can comment on or make changes to this bug.